PT-2025-5748 · Apache · Apache James

Benoit Tellier + 1 · Published 2025-02-05 · Updated 2025-09-01 · CVE-2024-37358

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.7.6 Apache James versions prior to 3.8.2

Description Apache James is susceptible to a denial of service through the misuse of IMAP literals by both authenticated and unauthenticated users. This could lead to unbounded memory allocation and prolonged computations.

Recommendations For Apache James version prior to 3.7.6, update to version 3.7.6 to restrict illegitimate use of IMAP literals. For Apache James version prior to 3.8.2, update to version 3.8.2 to mitigate the issue.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-400

CWE-770

CWE-20

Related Identifiers

BDU:2025-05245

CVE-2024-37358

GHSA-56JP-W6VW-J3JW

Affected Products

Apache James

References · 16

• https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05245 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37358 · Security Note
• https://osv.dev/vulnerability/GHSA-56jp-w6vw-j3jw · Vendor Advisory
• https://github.com/apache/james-project/commit/6dd3ad9ea1f6a9bc887d2c7af3f5aa30a60ec769 · Note
• https://github.com/apache/james-project · Note
• https://github.com/apache/james-project/commit/b2f3c06edfd37b409121bf04c56a6f026048a77e · Note
• https://twitter.com/oss_security/status/1887197814679130450 · Twitter Post
• https://t.me/cvedetector/17380 · Telegram Post
• https://t.me/cvenotify/110217 · Telegram Post
• https://t.me/cveNotify/134033 · Telegram Post
• https://twitter.com/CVEnew/status/1887465531403608135 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1887712998258843843 · Twitter Post
• https://twitter.com/HunterMapping/status/1887794038742409419 · Twitter Post